[Solved] Server 2008 SP2 - SCEP/MSSE definition updates

Discussion in 'Windows Server' started by Carlos Detweiller, Sep 24, 2020.

Tags:
Thread Status:
Not open for further replies.
  1. Carlos Detweiller

    Carlos Detweiller Emperor of Ice-Cream
    Staff Member

    Dec 21, 2012
    7,407
    9,121
    240
    #1 Carlos Detweiller, Sep 24, 2020
    Lately (since end of August), SCEP (MSSE, too) does not seem to be able to update its definitions on Server 2008 SP2 (NT 6.0). Running the same on Windows 7 is fine, however.

    Even a complete reset or new installation does this. 0x80070643

    Did MS b0rk it on Server 2008 SP2?


    (Unfortunately, I also can't find any other free AV that will run in Server 2008 SP2.)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    17,810
    94,910
    340
    #2 abbodi1406, Sep 26, 2020
  3. Carlos Detweiller

    Carlos Detweiller Emperor of Ice-Cream
    Staff Member

    Dec 21, 2012
    7,407
    9,121
    240
    #3 Carlos Detweiller, Sep 27, 2020 (OP)
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    17,810
    94,910
    340
    #4 abbodi1406, Sep 27, 2020
    It worked here
    extracted mpas-fe.exe with 7-zip
    replaced the new mpengine.dll
    ran following cmd as admin
    Code:
    MpSigStub.exe /stub 1.1.16900.5 /payload 0.0.0.0
    you may need to clear this folder first
    C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\

    the missing kernel32.dll's TryAcquireSRWLockExclusive broke a lot of programs on NT 6.0
     
  5. Carlos Detweiller

    Carlos Detweiller Emperor of Ice-Cream
    Staff Member

    Dec 21, 2012
    7,407
    9,121
    240
    #5 Carlos Detweiller, Sep 27, 2020 (OP)
    Yes, I got it to work. For some reason, my old extracted mpas-fe.exe directory missed the dynamics (maybe because it was a fresh cycle). I just got and extracted mpas-d.exe, too, for the dynamics.

    The complete set (5 files, including the compatible mpengine.dll) copied to "C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Updates\" triggers an immediate update (the files will disappear). If the set is missing files, nothing will update, but the files disappear, too.

    Code:
    mpasbase.vdm
mpasdlta.vdm
mpavbase.vdm
mpavdlta.vdm
mpengine.dll
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...